1. Field of the Invention
The present invention relates to network traffic sampling and more specifically to trajectory-based and threshold-based network traffic sampling.
2. Introduction
Routers summarize traffic flows in flow records which are exported to collectors, possibly through a mediation device. The mediation device has the ability to sample or otherwise select subsets of flow records in order to achieve different traffic analysis goals. Some current approaches to network traffic sampling include trajectory based (or hash based) sampling and threshold based sampling. Trajectory based sampling observes trajectories at each router of a subset of all packets traversing the network. Threshold sampling observes a subset of flow records based on a threshold, such as flow size. None of these methods can consistently select subsets of flow records generated by different routers that a flow traverses with a selection probability that depends on the fields of the flow record. A given flow record can not be selected either at routers it traverses with a specified selection probability. Accordingly, what is needed in the art is an improved way to sample network traffic that blends characteristics of trajectory based sampling and threshold based sampling.